QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect oracle staleness check operator causes valid data rejection

goran

Summary

The UpdateWeightRunner implements oracle staleness checks using a strict greater than operator (>) instead of greater than or equal to (>=). This causes the contract to reject oracle data that is exactly at the staleness threshold age, leading to unnecessary fallbacks to backup oracles.

Vulnerability Details

Current implementation:

function _getData(address _pool, bool internalCall) private view returns (int256[] memory outputData) {
uint oracleStalenessThreshold = IQuantAMMWeightedPool(_pool).getOracleStalenessThreshold();
// ...
if (oracleResult.timestamp > block.timestamp - oracleStalenessThreshold) {
outputData[i] = oracleResult.data;
} else {
// Unnecessarily falls back to backup oracles
}
}

Example scenario:

Current block.timestamp = 1000
oracleStalenessThreshold = 100
Oracle last update timestamp = 900
​
Check: 900 > (1000 - 100)
900 > 900
false // Data rejected even though it's exactly at threshold

Impact

  • Unnecessarily rejects valid oracle data

  • Increases gas costs through avoidable fallback oracle usage

  • Creates inconsistent behavior at threshold boundary

  • Low severity as it only affects edge cases and has fallback mechanism

Tools Used

Manual code review

Recommendations

Change the comparison operator to greater than or equal to:

function _getData(address _pool, bool internalCall) private view returns (int256[] memory outputData) {
uint oracleStalenessThreshold = IQuantAMMWeightedPool(_pool).getOracleStalenessThreshold();
// ...
if (oracleResult.timestamp >= block.timestamp - oracleStalenessThreshold) {
outputData[i] = oracleResult.data;
} else {
// Proceed to backup oracles only if data is truly stale
}
}

This ensures that data exactly at the threshold age is considered fresh, which is the expected behavior for oracle staleness checks.

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!